samuraictf / gatekeeper

GATEKEEPER: Inline and on-target defense
119 stars 15 forks source link

./regex in branch hax/ebeip90 issue #35

Open ghost opened 9 years ago

ghost commented 9 years ago
memcpy_avx_unaligned () at ../sysdeps/x86_64/multiarch/memcpy-avx-unaligned.S:267
267     ../sysdeps/x86_64/multiarch/memcpy-avx-unaligned.S: No such file or directory.
gdb$ bt
#0  __memcpy_avx_unaligned () at ../sysdeps/x86_64/multiarch/memcpy-avx-unaligned.S:267
#1  0x0000000000401677 in perform_pcre_filter (fd=0x1, ctx=0x604010, buf=0x7fffffffdd68, used=0x7fffffffdd78, allocated=0x7fffffffdd70) at regex.c:154
#2  0x0000000000401ecb in proxy_pump () at proxy.c:231
#3  0x0000000000401960 in main (argc=0x4, argv=0x7fffffffdeb8) at main.c:26
gdb$ quit

 // XXX bytes-avail > sizeof(buffer)?  might be the bug...
    if(bytes > available) {
        size_t shift_idx = bytes - available;
        size_t shift_size = sizeof(data->buffer) - shift_idx;

        memcpy(data->buffer, &data->buffer[shift_idx], shift_size);
        data->used -= shift_idx;
    }

    // Copy in the new data
    memcpy(&data->buffer[data->used], *buf, bytes);
    data->used += bytes;
zachriggle commented 9 years ago

The original crash leads me to believe we're providing a negative value to the last argument of memcpy.

=================================================================
==25305==ERROR: AddressSanitizer: negative-size-param: (size=-483)
   #0 0x4a5d4a  (/home/w/ctf/gatekeeper/regex/regex+0x4a5d4a)
   #1 0x4dddaf  (/home/w/ctf/gatekeeper/regex/regex+0x4dddaf)
   #2 0x4e1631  (/home/w/ctf/gatekeeper/regex/regex+0x4e1631)
   #3 0x4df091  (/home/w/ctf/gatekeeper/regex/regex+0x4df091)
   #4 0x7fe121cd7a3f  (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f)
   #5 0x4356b8  (/home/w/ctf/gatekeeper/regex/regex+0x4356b8)

AddressSanitizer can not describe address in more detail (wild memory access suspected).
==25305==ABORTING